thinkpool-pair 0.7.178 → 0.7.180

package/README.md

@@ -120,10 +120,17 @@ ThinkPool Code runs **any model you choose** — not just Anthropic. The agent
 talks the Anthropic Messages API, so you point it at any endpoint that speaks
 that format:
 
-- **Anthropic-compatible endpoints directly** — Z.ai GLM, OpenRouter, your own proxy.
-- **Any other model via a gateway** — put a translator like **LiteLLM** or
-  OpenRouter in front and run **GPT, Gemini, Llama, DeepSeek, or a local model**;
-  the gateway presents the Anthropic Messages API while calling whatever you pick.
+- **Anthropic-compatible endpoints directly** — Z.ai GLM, Moonshot Kimi, OpenRouter, your own proxy.
+- **Any other model via a translating gateway** — put **LiteLLM** (or a proxy of
+  your own) in front and run **GPT, Gemini, Llama, DeepSeek, or a local model**;
+  it presents the Anthropic Messages API while calling whatever you pick.
+
+> OpenRouter is the exception worth knowing: its `/v1/messages` surface is a
+> pass-through for **Anthropic models only**. Per OpenRouter's own docs, "Claude
+> Code expects Anthropic request semantics, so non-Anthropic models aren't
+> supported through the native endpoint" — and this bridge spawns the `claude`
+> CLI. To reach a non-Anthropic model, use a translating gateway (LiteLLM),
+> not OpenRouter's Anthropic endpoint.
 
 ```bash
 npx thinkpool-pair provider custom --base <url> --token <key> [--model <name>]
@@ -134,7 +141,8 @@ Common base urls (the agent appends `/v1/messages`):
 | Provider / gateway | Base url                          | Models                       |
 |--------------------|-----------------------------------|------------------------------|
 | Z.ai GLM           | `https://api.z.ai/api/anthropic`  | GLM                          |
-| OpenRouter         | `https://openrouter.ai/api`       | many, incl. non-Anthropic    |
+| Moonshot Kimi      | `https://api.moonshot.ai/anthropic` | Kimi                       |
+| OpenRouter         | `https://openrouter.ai/api`       | Anthropic models only        |
 | LiteLLM (your own) | `http://localhost:4000`           | GPT, Gemini, Llama, local, … |
 
 > The endpoint must serve the Anthropic Messages API (`/v1/messages`). A raw

package/bridge.mjs

@@ -45,8 +45,8 @@ import { createPermNotifier, shouldNotifyTurnDone, permissionSummary, clipSummar
 // resolveProviderEnv(id) → {ANTHROPIC_BASE_URL,ANTHROPIC_AUTH_TOKEN,ANTHROPIC_MODEL} for a
 // registered custom provider, or null for the built-in/unknown (leave the default env intact).
 // Multi-provider BYOK slice 1: a lane spawned with a `provider` id runs on that endpoint.
-import { resolveProviderEnv, providerNameMap, publicKeyB64, announceProviders, listProviders, addProvider, removeProvider, unseal, effectiveLaneModel } from './providers.mjs'
-import { validateProviderSwitch, BUILTIN_PROVIDER } from './switch-provider.mjs'
+import { resolveProviderEnv, providerNameMap, publicKeyB64, announceProviders, listProviders, addProvider, removeProvider, unseal, effectiveLaneModel, sameProviderEnv, providerModel } from './providers.mjs'
+import { validateProviderSwitch, providerSwitchPlan, BUILTIN_PROVIDER } from './switch-provider.mjs'
 import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk'
 import { z } from 'zod'
 import { startClaudeSession } from './claude-session.mjs'
@@ -1566,7 +1566,7 @@ function worktreeSnapshot(cwd) {
 // relay STRUCTURED events. onEvent → broadcast `code-event` + print locally +
 // persist to the host file; tool calls round-trip through the perm card; the
 // rolling log replays to joiners and survives bridge restarts (session-store).
-function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rolePrompt, flowSessionId, flowTaskKey, cwd, reviewSliceRoots, openedAt, defer, provider, carryRecap }) {
+function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rolePrompt, flowSessionId, flowTaskKey, cwd, reviewSliceRoots, openedAt, defer, provider, carryRecap, lastUsage }) {
   if (sessions.has(id)) return
   // The lane's EFFECTIVE model — computed ONCE and used for BOTH the truthful display
   // label (entry.model) and the SDK's `model` option below. These used to be computed
@@ -1608,6 +1608,12 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
   // event-id.mjs + src/pages/code/seqDedup.js). pushLog() is the single stamp point.
   entry.seq = makeSeqCounter(maxSeq(entry.log))
   entry.rolePrompt = rolePrompt || null   // FL-M6 — persisted so a bridge restart restores the flow role prompt
+  // lastUsage — the terminal's most recent usage/ctx meter. Persisted (sessionData) +
+  // restored so a bridge restart can re-emit it on replay: usage is chrome (kept out of
+  // the replayed transcript log), so without this a (re)joiner sees "—" for context until
+  // the terminal's next turn. correctContext nulls ctx for models whose true window we
+  // can't determine; those restore a null ctx and replay nothing (no misleading %).
+  entry.lastUsage = lastUsage || null
   // S5 (slice 1b) — a REVIEW lane's write-block scope: the worktree root(s) of the slice(s)
   // it reviews (its deps). Persisted so a bridge restart re-arms the structural gate. Empty/
   // absent on builder lanes → reviewGate stays null → builder toolset UNCHANGED.
@@ -1775,7 +1781,7 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
   // restart. Without this, sessionData omitted it → on restart the resumed session
   // re-launched on the host default (Opus) regardless of the last switch, and the
   // switch looked like it "never changed the model" (Max 2026-07-02). Restored below.
-  const sessionData = () => ({ sessionId: entry.session?.sessionId || resume || null, log: entry.log, commands: entry.commands, mode: entry.mode, model: entry.model || null, provider: entry.provider || null, spawnedBy: entry.spawnedBy, flowSessionId: entry.flowSessionId, flowTaskKey: entry.flowTaskKey, cwd: entry.cwd, rolePrompt: entry.rolePrompt, flowReviewTarget: entry.flowReviewTarget || null, revertTarget: entry.revertTarget || null, reviewSliceRoots: entry.reviewSliceRoots || [], openedAt: entry.openedAt || null })
+  const sessionData = () => ({ sessionId: entry.session?.sessionId || resume || null, log: entry.log, commands: entry.commands, mode: entry.mode, model: entry.model || null, provider: entry.provider || null, spawnedBy: entry.spawnedBy, flowSessionId: entry.flowSessionId, flowTaskKey: entry.flowTaskKey, cwd: entry.cwd, rolePrompt: entry.rolePrompt, flowReviewTarget: entry.flowReviewTarget || null, revertTarget: entry.revertTarget || null, reviewSliceRoots: entry.reviewSliceRoots || [], openedAt: entry.openedAt || null, lastUsage: entry.lastUsage || null })
   const persist = () => saveSession(room, id, sessionData())
   // Synchronous flush of this session's record. Used on open (so a brand-new session
   // has a file under its id BEFORE its first event — surviving a restart inside the
@@ -2227,6 +2233,10 @@ function openStructured({ id, model, resume, log, commands, mode, spawnedBy, rol
         const m = onBuiltin ? (evt.model || evt.ctx?.model) : null
         if (m && m !== entry.model) { entry.model = m; announce() }
         if (evt.kind === 'models' && Array.isArray(evt.models) && evt.models.length) { roomModels = evt.models; announce() } }
+      // Cache the last usage/ctx meter on the entry (persisted + replayed — see
+      // openStructured). Chrome events bypass pushLog/persist in emitTail below, so
+      // usage needs an explicit persist() here to survive a bridge restart.
+      if (evt.kind === 'usage') { entry.lastUsage = evt; persist() }
       // FL-B2 — fold this flow lane's completed-turn output tokens into its budget so the
       // autopilot cap can halt the next wave before overrun (output_tokens = the billed
       // reasoning+output spend the indicator already tracks; conservative enough for a guard).
@@ -2473,7 +2483,16 @@ function respawnStructured(id, provider) {
   const s = sessions.get(id)
   if (!s) return false
   // Capture the lane's identity for re-open (NOT resume — fresh SDK session).
-  const { model, log, commands, mode, spawnedBy, flowSessionId, flowTaskKey, cwd, rolePrompt, reviewSliceRoots, openedAt } = s
+  // NOTE the deliberate absence of `model`: a respawn crosses a provider boundary,
+  // and the old lane's model id means nothing on the new backend. Carrying it sent
+  // `glm-4.6` to Anthropic on a GLM→Claude switch, and — once effectiveLaneModel
+  // started honouring explicit non-Claude ids — pinned a GLM→GLM-5.2 switch back to
+  // glm-4.6, so the lane truthfully labelled the model it was wrongly still running
+  // (Max, 2026-07-09: "selecting 5.2 still shows 4.6"). Omitting it lets
+  // openStructured seed from the TARGET provider's configured model, which is the
+  // only model this lane was ever asked for. A same-env model change never reaches
+  // here — that path is an in-place setModel (see provider-switch).
+  const { log, commands, mode, spawnedBy, flowSessionId, flowTaskKey, cwd, rolePrompt, reviewSliceRoots, openedAt } = s
   // Context-carry (2026-07-08): a provider switch is not an SDK resume — the new backend
   // starts blank mid-conversation. Synthesize a plain-text recap from the VISIBLE log NOW
   // (before teardown) and hand it to the fresh session as its first turn so the agent
@@ -2491,7 +2510,33 @@ function respawnStructured(id, provider) {
   // sessionData() (provider included) synchronously on open, so a bridge restart
   // restores the lane on its CURRENT provider, not the original — and its next
   // announce carries the new provider badge (additive {id,name} projection).
-  openStructured({ id, model, provider, log, commands, mode, spawnedBy, flowSessionId, flowTaskKey, cwd, rolePrompt, reviewSliceRoots, openedAt, carryRecap })
+  openStructured({ id, provider, log, commands, mode, spawnedBy, flowSessionId, flowTaskKey, cwd, rolePrompt, reviewSliceRoots, openedAt, carryRecap })
+  return true
+}
+
+/**
+ * Switch a lane between two providers that share an endpoint AND a key — i.e. two
+ * registry rows for the same z.ai/OpenRouter/proxy account, differing only in model.
+ *
+ * Nothing about the child's env changes except ANTHROPIC_MODEL, and the SDK's `model`
+ * option overrides that anyway, so there is no reason to tear the agent down. setModel()
+ * re-creates the query with `resume`, which keeps the SDK context (and defers a mid-turn
+ * switch to turn-end). The lane keeps its memory; only the model moves.
+ *
+ * Returns false when the lane is gone or the target has no configured model — the caller
+ * falls back to a full respawn rather than leaving the lane on a stale model.
+ */
+function switchModelInPlace(id, provider) {
+  const s = sessions.get(id)
+  if (!s?.session) return false
+  const nextModel = providerModel(provider)
+  if (!nextModel) return false            // no model to switch TO → let respawn seed the env
+  s.provider = provider || null
+  s.model = nextModel                     // truthful label; announce reads this
+  try { s.session.setModel(nextModel) } catch { return false }
+  // Persist through the entry's own closure (sessionData is private to openStructured),
+  // so a bridge restart restores the lane on the row it was switched TO, not the origin.
+  try { s.flush?.() } catch { /* disk full / racing close — the debounced save still runs */ }
   return true
 }
 
@@ -2677,8 +2722,16 @@ channel
       // the terminal. chunkReplayEvents splits it so nothing in the recent window is lost;
       // classifyReplay applies the chunks in arrival order. Older history beyond the chunk
       // budget is covered by the client's DB transcript snapshot.
+      // Attach the terminal's last usage/ctx meter to the FIRST replay chunk. usage is
+      // chrome (filtered out of `events` by both bridge + client), so without this a
+      // (re)joiner's ctx meter is empty ("—") until the terminal's next turn. The client
+      // applies `payload.lastUsage` in its code-replay handler (which is `to`-targeted, so
+      // only the joiner gets it). Gated on `.ctx` — a suppressed meter (correctContext
+      // nulled it for an unknown non-Claude model) replays nothing, never a misleading %.
+      let firstChunk = true
       for (const events of chunkReplayEvents(tail)) {
-        bcast('code-replay', { to: payload?.to ?? null, term: id, events, ...(ahead ? { reset: true } : {}) })
+        bcast('code-replay', { to: payload?.to ?? null, term: id, events, ...(ahead ? { reset: true } : {}), ...(firstChunk && s.lastUsage?.ctx ? { lastUsage: s.lastUsage } : {}) })
+        firstChunk = false
       }
     }
     // Re-send any still-pending permission/question cards. They ride a one-shot
@@ -2953,7 +3006,9 @@ channel
   // projection the client already renders from #219). Spec: docs/specs/2026-07-05-provider-switch.md.
   .on('broadcast', { event: 'provider-switch' }, async ({ payload }) => {
     const nonce = payload?.nonce
-    const reply = (ok, error) => channel.send({ type: 'broadcast', event: 'provider-switch-res', payload: { nonce, ok, ...(error ? { error } : {}) } })
+    // `restarted` (0.7.179+): did the agent lose its context? false for a same-key model
+    // change, true for a real provider change. Older clients ignore the extra field.
+    const reply = (ok, error, restarted) => channel.send({ type: 'broadcast', event: 'provider-switch-res', payload: { nonce, ok, ...(error ? { error } : {}), ...(restarted === undefined ? {} : { restarted }) } })
     // AUTH first — anon / non-participant / bad jwt → ok:false 'unauthorized'. No lane
     // state is touched for a rejected sender (fail closed before any lookup).
     if (!(await isRoomParticipant(payload?.jwt))) return reply(false, 'unauthorized')
@@ -2968,12 +3023,32 @@ channel
       registeredIds: listProviders().map((p) => p.id),
     })
     if (!v.ok) return reply(false, v.error)
-    if (v.noop) return reply(true)   // nothing to do; idempotent ok (UI guarantees a change)
     const target = payload?.provider === BUILTIN_PROVIDER ? null : payload?.provider
+
+    // The three-way choice is pure + unit-tested (switch-provider.mjs). Two registry rows
+    // on ONE endpoint + key (Max's glm-4.6 and glm-5.2 on the same z.ai account) are the
+    // same provider asked for a different model: the child's env is identical, so tearing
+    // the agent down and recapping it is pure loss. Only a different endpoint/key earns a
+    // respawn. An in-place attempt that fails (lane raced closed, setModel threw) falls
+    // back to the respawn rather than leaving the lane on a stale model.
+    const plan = providerSwitchPlan({
+      provider: payload?.provider,
+      currentProvider: s.provider,
+      sameEnv: sameProviderEnv(s.provider, target),
+      targetModel: providerModel(target),
+    })
+    if (plan.action === 'noop') return reply(true, undefined, false)   // idempotent (UI guarantees a change)
+
+    if (plan.action === 'in-place' && switchModelInPlace(term, target)) {
+      process.stderr.write(`\n  ◆ lane ${String(term).slice(0, 8)} switched model → ${providerModel(target)} (same key, context kept).\n`)
+      announce()
+      return reply(true, undefined, false)
+    }
+
     const done = respawnStructured(term, target)
     if (!done) return reply(false, 'no such live lane')   // raced closed between the lookup + respawn
     process.stderr.write(`\n  ◆ lane ${String(term).slice(0, 8)} switched provider → ${target || 'anthropic'} (memory reset, transcript kept).\n`)
-    reply(true)
+    reply(true, undefined, true)
   })
   .subscribe(status => {
     if (status === 'SUBSCRIBED') {
@@ -3003,7 +3078,7 @@ channel
             // FL-M6 — restore the flow context (id/role/cwd) so an in-flight flow survives a
             // bridge restart: the conductor keeps its subagent-block + plan interception, and
             // lanes keep their worktree cwd + the ability to mark done.
-            openStructured({ id: rec.id, model: rec.model || undefined, provider: rec.provider || undefined, resume: canResume(rec) ? rec.sessionId : undefined, log: rec.log, commands: rec.commands, mode: rec.mode, spawnedBy: rec.spawnedBy, flowSessionId: rec.flowSessionId, flowTaskKey: rec.flowTaskKey, cwd: rec.cwd, rolePrompt: rec.rolePrompt, reviewSliceRoots: rec.reviewSliceRoots, openedAt: rec.openedAt,
+            openStructured({ id: rec.id, model: rec.model || undefined, provider: rec.provider || undefined, resume: canResume(rec) ? rec.sessionId : undefined, log: rec.log, commands: rec.commands, mode: rec.mode, spawnedBy: rec.spawnedBy, flowSessionId: rec.flowSessionId, flowTaskKey: rec.flowTaskKey, cwd: rec.cwd, rolePrompt: rec.rolePrompt, reviewSliceRoots: rec.reviewSliceRoots, openedAt: rec.openedAt, lastUsage: rec.lastUsage,
               // Lazy-boot restored terminals that were IDLE + not part of a flow: their transcript
               // shows immediately; the query boots on first turn. Mid-turn + flow terminals boot now
               // (mid-turn needs auto-resume; flow needs its lane live).

package/context-windows.mjs

@@ -86,7 +86,13 @@ export function correctContext(raw, env = process.env) {
   const correctedMax = override ?? mapped
 
   if (correctedMax == null) {
-    // No correction available — but never ship a >100% pct.
+    // No correction available. For a NON-Claude model the SDK's max is computed for the
+    // wrong model id (it believes it's talking to Claude over ANTHROPIC_BASE_URL) → a %
+    // off that wrong max misleads (the GLM-ran-past-100 bug, 2026-07-04). Rather than ship
+    // a wrong number, SUPPRESS the meter: return null so the mode row + Session info show
+    // nothing / "—" instead. We only display ctx when we know the true window — a Claude
+    // id (SDK max trusted), a known-map model (corrected above), or TP_CONTEXT_MAX (override).
+    if (!isClaudeModel(raw.model)) return null
     const pct = Number(raw.pct)
     if (Number.isFinite(pct) && pct > 100) return { ...raw, pct: 100, over: true }
     return raw

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.178",
+  "version": "0.7.180",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {

package/providers.mjs

@@ -247,6 +247,55 @@ export function removeProvider(id) {
   return { ok: true }
 }
 
+/* ── the provider GROUP token (Max, 2026-07-09) ──────────────────────────
+   Two registry rows are the SAME PROVIDER when they point at the same endpoint
+   with the same key — they differ only in which model they ask it for. That is
+   the identity that matters: it decides whether the switch menu unites them, and
+   whether switching between them needs a fresh agent (it doesn't — same env).
+
+   Before this, the clients grouped on `brandKey(name)`: the first whitespace token
+   of the user's DISPLAY NAME, lowercased. "GLM" → `glm`, "GLM-5.2" → `glm5.2`, so
+   Max's two models on one z.ai key rendered as two unrelated providers, each
+   threatening to restart his agent. Identity was being derived from a label.
+
+   `group` is a one-way digest of baseUrl + key, NOT either value. It is safe on
+   the announce (which deliberately carries neither): a 12-hex prefix reveals only
+   *sameness*, and preimaging it means preimaging the key. The built-in Anthropic
+   has no stored key, so it gets the literal 'anthropic' — it groups with nothing.
+
+   NUL-separated so ("https://a.io/x", "key") and ("https://a.io/xkey", "") can't
+   collide into one group. */
+export function providerGroup(p) {
+  if (!p || p.id === BUILTIN_ID) return BUILTIN_ID
+  return crypto.createHash('sha256')
+    .update(`${p.baseUrl || ''}\0${p.key || ''}`)
+    .digest('hex')
+    .slice(0, 12)
+}
+
+/**
+ * Do these two registered providers share an endpoint AND a key? Then a switch
+ * between them changes only ANTHROPIC_MODEL — the child's env is otherwise
+ * identical, so the live session can just setModel() and keep its context
+ * instead of being torn down and recapped. Built-in ↔ custom is never same-env.
+ */
+export function sameProviderEnv(idA, idB) {
+  const a = effectiveId(idA), b = effectiveId(idB)
+  if (a === BUILTIN_ID || b === BUILTIN_ID) return a === b   // both built-in, or one of them
+  const arr = loadProviders()
+  const pa = arr.find((x) => x.id === a), pb = arr.find((x) => x.id === b)
+  if (!pa || !pb) return false                                // unknown id → never same
+  return providerGroup(pa) === providerGroup(pb)
+}
+
+const effectiveId = (p) => (!p || p === BUILTIN_ID) ? BUILTIN_ID : String(p)
+
+/** The model a registered provider is configured to ask for (null for built-in/unknown). */
+export function providerModel(id) {
+  if (!id || id === BUILTIN_ID) return null
+  return loadProviders().find((x) => x.id === id)?.model || null
+}
+
 // ── read-only projections (never expose the raw key) ────────────────────
 /** Masked list for the dashboard: keyHint = last 4 chars only. Built-in first. */
 export function listProviders() {
@@ -254,15 +303,16 @@ export function listProviders() {
     id: p.id,
     name: p.name,
     model: p.model || null,
+    group: providerGroup(p),
     keyHint: keyHint(p.key),
   }))
-  return [{ id: BUILTIN_ID, name: 'Anthropic (Claude)', model: null, keyHint: null }, ...custom]
+  return [{ id: BUILTIN_ID, name: 'Anthropic (Claude)', model: null, group: BUILTIN_ID, keyHint: null }, ...custom]
 }
 
 /** Name-only projection for the announce/presence payload — NO key, NO baseUrl. */
 export function announceProviders() {
-  const custom = loadProviders().map((p) => ({ id: p.id, name: p.name, model: p.model || null }))
-  return [{ id: BUILTIN_ID, name: 'Anthropic (Claude)', model: null }, ...custom]
+  const custom = loadProviders().map((p) => ({ id: p.id, name: p.name, model: p.model || null, group: providerGroup(p) }))
+  return [{ id: BUILTIN_ID, name: 'Anthropic (Claude)', model: null, group: BUILTIN_ID }, ...custom]
 }
 
 /**

package/switch-provider.mjs

@@ -55,3 +55,30 @@ export function validateProviderSwitch({ provider, currentProvider, registeredId
   const noop = effectiveProvider(id) === effectiveProvider(currentProvider)
   return { ok: true, noop }
 }
+
+/**
+ * WHAT KIND of switch is this? The pure half of the provider-switch handler, so the
+ * three-way choice is testable without booting a bridge (Max, 2026-07-09).
+ *
+ *   'noop'     — same provider; nothing to do.
+ *   'in-place' — a different registry row on the SAME endpoint + key (two models on
+ *                one z.ai account). Only ANTHROPIC_MODEL differs, so the live session
+ *                just setModel()s and KEEPS ITS CONTEXT. Requires a model to switch to.
+ *   'respawn'  — a genuinely different endpoint or key. Fresh agent, transcript kept,
+ *                recap carried. This is the only case that costs the user their context.
+ *
+ * `sameEnv` is supplied by the caller (providers.mjs `sameProviderEnv`) rather than
+ * imported, so this module stays free of registry/disk state — the whole point of it.
+ * A same-env target with NO configured model falls back to 'respawn': openStructured
+ * would then seed the model from the target's env, which an in-place setModel cannot do.
+ *
+ * @param {{provider:string, currentProvider?:string|null, sameEnv:boolean, targetModel?:string|null}} input
+ * @returns {{action:'noop'|'in-place'|'respawn', restarted:boolean}}
+ */
+export function providerSwitchPlan({ provider, currentProvider, sameEnv, targetModel }) {
+  if (effectiveProvider(provider) === effectiveProvider(currentProvider)) {
+    return { action: 'noop', restarted: false }
+  }
+  if (sameEnv && targetModel) return { action: 'in-place', restarted: false }
+  return { action: 'respawn', restarted: true }
+}